We care about your privacy. Below, we explain what data we collect, for what purpose we process it, to whom we entrust it, and what rights you have.
Version effective from August 21, 2026
01
Data Controller
The controller of your personal data is Kawa Abol Sp. z o.o. with its registered office in Poznań (61-723) at ul. Nowowiejskiego 20 lok. 2, NIP 7831957520, REGON 545174904, KRS 0001252206.
For all matters regarding personal data protection, you can contact us at kontakt.kawaabol@gmail.com or in writing at our registered office address.
We process data in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Personal Data Protection Act.
The Controller has not appointed a Data Protection Officer — tasks related to personal data protection are performed directly by the Controller, who can be contacted at kontakt.kawaabol@gmail.com.
02
What Data We Collect
The scope of data collected depends on how you use our store.
When placing an order
first name and last name;
delivery address (street, number, postal code, city) or selected InPost Parcel Locker;
e-mail address and phone number;
invoice details, including company name and NIP (tax identification number) — if you request an invoice;
information about ordered products, order value, and selected payment method.
When contacting via form or e-mail
first name and last name, e-mail address, optional phone number;
message content and order number, if provided.
Automatically while using the store
IP address and approximate location derived from the IP address;
browser type and version, operating system, device type;
information about visited subpages, visit duration, and entry source;
identifiers stored in cookies — details in point 9.
Important
We do not store your payment card details. Payments are handled by an external operator who processes card data on their own secure servers.
03
Purposes and Legal Basis
Purpose of processing
Legal basis
Order fulfillment and concluded sales agreement
Art. 6(1)(b) GDPR — necessity for the performance of a contract
Subscription and recurring delivery service
Art. 6(1)(b) GDPR — necessity for the performance of a contract
Handling complaints and withdrawals from the contract
Art. 6(1)(b) and (c) GDPR — contract and legal obligation
Issuing invoices and maintaining accounting records
Art. 6(1)(a) or (f) GDPR — consent for cookies or legitimate interest
Establishing, exercising, or defending claims
Art. 6(1)(f) GDPR — legitimate interest
Providing data is voluntary, but necessary for the conclusion and performance of the sales contract. Without it, we will not be able to accept and deliver your order.
04
Who We Entrust Data To
We transfer your data only to entities whose participation is necessary for the fulfillment of the order or the operation of the store. Each of them processes data based on a data processing agreement and only to the extent indicated by us.
Recipient
Scope and purpose
Shopify Inc.
Online store platform provider — store hosting, order and customer data management
InPost S.A.
Parcel delivery — address details, first and last name, phone, e-mail
Shopify Payments
Processing and settlement of electronic payments
Accounting office
Maintaining accounting and tax settlements
E-mail provider
Handling correspondence and order notifications
Data may also be disclosed to public authorities if such an obligation results from legal provisions. We do not sell or share your personal data for marketing purposes with third parties.
05
Transfers Outside the EEA
Some of our service providers, in particular Shopify Inc., are based outside the European Economic Area. This means that your data may be transferred to third countries, including the United States and Canada.
The transfer takes place on the basis of safeguards provided for in Chapter V of the GDPR — in particular, standard contractual clauses approved by the European Commission or a decision stating an adequate level of protection.
5 years from the end of the calendar year in which the tax payment deadline expired
Data necessary for defending claims
Until the expiry of the limitation period for claims, generally 6 years
E-mail correspondence and form submissions
Up to 12 months from the end of the case
Newsletter subscribers' data
Until consent is withdrawn
Data from cookies
According to the validity period of individual files — up to 24 months
07
Your Rights
In connection with the processing of your personal data, you have the following rights:
Right of access to data
You can obtain information on whether and what data we process about you, and receive a copy of it.
Right to rectification
You can request the correction of inaccurate data or the completion of incomplete data.
Right to erasure
You can request the erasure of data, unless there is a legal obligation to the contrary, e.g., the need to store accounting documentation.
Right to restriction of processing
You can request the suspension of processing, e.g., for the period of verifying data accuracy.
Right to data portability
You can receive data in a structured format and transfer it to another controller.
Right to object
You can object at any time to processing based on our legitimate interest.
Right to withdraw consent
You can withdraw consent at any time. This does not affect the lawfulness of processing carried out before its withdrawal.
Right to lodge a complaint
You can lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.
To exercise any of the above rights, please write to us at kontakt.kawaabol@gmail.com. We will respond promptly, no later than one month from receiving the request.
08
Newsletter and Marketing
We send newsletters only to individuals who have voluntarily subscribed to the list and given their consent.
The newsletter includes information about new coffees, special offers, events, and content related to Ethiopian coffee culture.
You can unsubscribe from the newsletter at any time — by clicking the unsubscribe link in the footer of any message or by writing to us via e-mail.
Unsubscribing from the newsletter does not affect the fulfillment of placed orders or the coffee subscription service.
09
Cookies
Cookies are small text files stored on your device when you use the store. We use them to ensure the store functions correctly and to better adapt it to the needs of visitors.
Type
Purpose
Essential
Enable shopping cart functionality, login, order finalization, and security. Do not require consent.
Functional
Remember your preferences, e.g., shopping cart contents or selected delivery options.
Analytical
Allow us to understand how visitors use the store and improve its operation.
Marketing
Used to present tailored advertising content. Installed only with your consent.
Upon your first visit, we present a banner where you can accept or reject non-essential cookies.
You can change your preferences at any time in the store's privacy settings or in your browser settings.
Restricting the use of cookies may affect some functionalities of the store, especially the shopping cart's operation.
Detailed information on managing cookies can be found in your browser's documentation.
10
Data Security
We apply technical and organizational measures corresponding to the risk of infringement of the rights and freedoms of the data subjects.
The connection to the store is encrypted with the SSL protocol, which secures the data transmitted between your browser and the server.
Access to personal data is restricted to authorized persons who are obliged to maintain confidentiality.
In the event of a personal data breach that may result in a high risk to your rights and freedoms, we will inform you without undue delay.
11
Policy Changes
We reserve the right to make changes to this Privacy Policy, particularly in connection with changes in legal regulations, technological development, or changes in the scope of services provided.
The current version of the Policy is always available on this page, along with the indication of its effective date.
We will inform you about significant changes in advance by e-mail or a notice in the store.
12
Contact
If you have questions regarding the processing of your personal data or wish to exercise your rights, please contact us. Please also review our Store Regulations.